US Agencies Warn of Attacks on Industrial Refrigeration Systems

U.S. government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, seeking to disrupt service, trigger fire hazards and cause inventory losses.

The joint advisory from CISA, FBI, HHS, USDA and DOT says attackers may exploit authentication bypasses, arbitrary code injection and weak configurations to gain access and remotely alter settings, driving units into continuous heating and defrost cycles that could damage products or create safety risks, as well as deny visibility into current temperatures.

Evidence cited includes reports of hundreds of exposed refrigeration controllers found via the data platform Censys, with the majority of instances in France and notable exposures for Danfoss StoreView and Copeland/Dixell XWEB devices. The advisory notes attacks have affected a range of targets from major supermarket chains to small grocers and butchers across Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the United Kingdom.

The French Blood Establishment confirmed that a refrigeration equipment provider cyber incident raised temperature and defrost settings to extremely high levels at three plasma-storage facilities, though attribution remains unclear.

Practical response urged by the agencies includes using strong authentication, keeping systems updated, identifying internet-accessible systems, isolating OT devices, retiring legacy units, removing unnecessary remote access and securing necessary remote access. The advisory also calls for changing default passwords and monitoring for internet exposure to reduce attack surface.